APK ka SHA-256 aur Signature Verify Kaise Karein

APK ka file name, icon ya download button dekhkar publisher ki identity confirm nahi hoti. Koi bhi file rename ki ja sakti hai. Safer verification mein teen cheezein alag-alag check hoti hain: file ke exact bytes, APK ki digital signature, aur jis reference se aap compare kar rahe hain us source ki credibility. Inmein se ek check pass hona baaki checks ko replace nahi karta.

SHA-256 aur signing certificate kya batate hain?

SHA-256 poori APK file ka cryptographic fingerprint hota hai. Downloaded file ka hash published reference se exact match kare to dono files ke bytes same hain. Lekin hash match yeh prove nahi karta ki reference file genuine, authorized ya harmless hai. Agar attacker apni file aur uska hash dono publish kare, comparison phir bhi match hoga.

Digital signature doosra check hai. Android ke official app-signing guidance ke mutabik APK install ya update hone ke liye digitally signed hona zaroori hai. Certificate fingerprint signer ki public identity ka repeatable reference deta hai; woh private signing key reveal nahi karta.

Verification se pehle trusted reference collect karein

Publisher ya authorized distribution page ka exact URL independently open karein; forwarded message ke button par blindly depend na karein.
Expected package name, version, file size, SHA-256 aur signing-certificate SHA-256 fingerprint note karein.
Agar reference missing hai, “verified” assume na karein. Hamari APK release page par koi value tabhi compare karein jab woh clearly supplied ho.
Existing trusted installation ka certificate available ho to update file ko usi reference se compare karein.

Downloaded file ka SHA-256 compare karein

Download complete hone dein aur file ko edit, extract ya repack na karein.
Trusted desktop checksum utility se SHA-256 calculate karein. Windows, macOS aur Linux mein built-in command-line tools available hote hain; output 64 hexadecimal characters ka hota hai.
Uppercase/lowercase ignore ki ja sakti hai, lekin har hexadecimal character same hona chahiye. Spaces ya colon formatting hata kar compare kar sakte hain.
Ek bhi character different ho to file open na karein. File delete karke source aur expected checksum dobara verify karein.

File size match useful quick check hai, par checksum ka substitute nahi. Do different files ka size same ho sakta hai.

APK signature ko apksigner se verify karein

Android SDK Build Tools ka official apksigner APK signature validate aur signer certificates print kar sakta hai. Typical verification command hai: apksigner verify --verbose --print-certs app.apk. Tool ko successful verification report karna chahiye; printed signer certificate SHA-256 digest ko trusted reference se exact compare karein.

Sirf “verified” output kaafi nahi hai: woh batata hai ki APK ki included signature structurally valid hai, yeh nahi ki signer expected publisher hai. Expected certificate fingerprint se comparison essential hai. Android ki update requirements ke mutabik update ka application ID installed app jaisa hona chahiye, signing certificate match karna chahiye ya valid proof-of-rotation hona chahiye, aur version code acceptable hona chahiye.

Result ko sahi tarah interpret karein

Hash mismatch: downloaded bytes reference se different hain; stop karein.
Signature invalid: APK modified, corrupt ya incorrectly signed ho sakti hai; install na karein.
Signature valid, certificate different: file kisi key se signed hai, par expected publisher continuity prove nahi hoti.
Sab values match: aapne reference jaisi file aur expected signing identity confirm ki; absolute safety phir bhi guarantee nahi hoti.

Verification ke baad bhi requested permissions aur Play Protect warning review karein. Google ke Play Protect guidance ke mutabik service outside-Play apps ko scan kar sakti hai aur harmful ya unverified sensitive-permission apps par warning de sakti hai. Protection disable karke warning bypass karna verification step nahi hai.

Best rule: source, SHA-256, certificate aur permissions mein se koi important detail missing ya inconsistent ho to installation pause karein.

Broader checks ke liye APK safety checklist aur historical comparison ke liye version history dekhein. Yeh guide general Android verification samjhati hai; kisi specific APK ki authorization ya safety guarantee nahi karti.